In the Linux kernel, the following vulnerability has been resolved:
ata: libata-core: fix NULL pointer deref in atahostalloc_pinfo()
In an unlikely (and probably wrong?) case that the 'ppi' parameter of atahostallocpinfo() points to an array starting with a NULL pointer, there's going to be a kernel oops as the 'pi' local variable won't get reassigned from the initial value of NULL. Initialize 'pi' instead to '&atadummyportinfo' to fix the possible kernel oops for good...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "51973205824083735797812865537542239435",
"length": 682.0
},
"target": {
"file": "drivers/ata/libata-core.c",
"function": "ata_host_alloc_pinfo"
},
"signature_version": "v1",
"id": "CVE-2022-49731-239a9f29",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf476fe22aa1851bab4728e0c49025a6a0bea307"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "51973205824083735797812865537542239435",
"length": 682.0
},
"target": {
"file": "drivers/ata/libata-core.c",
"function": "ata_host_alloc_pinfo"
},
"signature_version": "v1",
"id": "CVE-2022-49731-29d5d387",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca4693e6e06e4fd2b240c0fec47aa2498c94848e"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "51973205824083735797812865537542239435",
"length": 682.0
},
"target": {
"file": "drivers/ata/libata-core.c",
"function": "ata_host_alloc_pinfo"
},
"signature_version": "v1",
"id": "CVE-2022-49731-2b69030f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36cd19e7d4e5571d77a2ed20c5b6ef50cf57734a"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "51973205824083735797812865537542239435",
"length": 682.0
},
"target": {
"file": "drivers/ata/libata-core.c",
"function": "ata_host_alloc_pinfo"
},
"signature_version": "v1",
"id": "CVE-2022-49731-34270c8a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ac5efee33f29e704226506d429b84575a5d66f8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"67777713513585031191794997350093110796",
"58478344964600928120531969734835269947",
"219351525089528926372144488224023144143",
"286598888391837768786036573192134052458",
"220848684778454364547773358663705417634",
"263335761710138676059012433263604661065",
"256635604553027450895274927888125010123",
"220583315956756343355432770079647256715"
]
},
"target": {
"file": "drivers/ata/libata-core.c"
},
"signature_version": "v1",
"id": "CVE-2022-49731-386a1b54",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36cd19e7d4e5571d77a2ed20c5b6ef50cf57734a"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"67777713513585031191794997350093110796",
"58478344964600928120531969734835269947",
"219351525089528926372144488224023144143",
"286598888391837768786036573192134052458",
"220848684778454364547773358663705417634",
"263335761710138676059012433263604661065",
"256635604553027450895274927888125010123",
"220583315956756343355432770079647256715"
]
},
"target": {
"file": "drivers/ata/libata-core.c"
},
"signature_version": "v1",
"id": "CVE-2022-49731-3eda8e8a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ac5efee33f29e704226506d429b84575a5d66f8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "51973205824083735797812865537542239435",
"length": 682.0
},
"target": {
"file": "drivers/ata/libata-core.c",
"function": "ata_host_alloc_pinfo"
},
"signature_version": "v1",
"id": "CVE-2022-49731-4e40437a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff128fbea720bf763fa345680dda5f050bc24a47"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"67777713513585031191794997350093110796",
"58478344964600928120531969734835269947",
"219351525089528926372144488224023144143",
"286598888391837768786036573192134052458",
"220848684778454364547773358663705417634",
"263335761710138676059012433263604661065",
"256635604553027450895274927888125010123",
"220583315956756343355432770079647256715"
]
},
"target": {
"file": "drivers/ata/libata-core.c"
},
"signature_version": "v1",
"id": "CVE-2022-49731-554003cf",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff128fbea720bf763fa345680dda5f050bc24a47"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "51973205824083735797812865537542239435",
"length": 682.0
},
"target": {
"file": "drivers/ata/libata-core.c",
"function": "ata_host_alloc_pinfo"
},
"signature_version": "v1",
"id": "CVE-2022-49731-598d52ce",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07cbdb4807d369fbda73062a91b570c4dc5ec429"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"67777713513585031191794997350093110796",
"58478344964600928120531969734835269947",
"219351525089528926372144488224023144143",
"286598888391837768786036573192134052458",
"220848684778454364547773358663705417634",
"263335761710138676059012433263604661065",
"256635604553027450895274927888125010123",
"220583315956756343355432770079647256715"
]
},
"target": {
"file": "drivers/ata/libata-core.c"
},
"signature_version": "v1",
"id": "CVE-2022-49731-6563d19d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@253334f84c81bc6a43af489f108c0bddad989eef"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"67777713513585031191794997350093110796",
"58478344964600928120531969734835269947",
"219351525089528926372144488224023144143",
"286598888391837768786036573192134052458",
"220848684778454364547773358663705417634",
"263335761710138676059012433263604661065",
"256635604553027450895274927888125010123",
"220583315956756343355432770079647256715"
]
},
"target": {
"file": "drivers/ata/libata-core.c"
},
"signature_version": "v1",
"id": "CVE-2022-49731-96413e6f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf476fe22aa1851bab4728e0c49025a6a0bea307"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"67777713513585031191794997350093110796",
"58478344964600928120531969734835269947",
"219351525089528926372144488224023144143",
"286598888391837768786036573192134052458",
"220848684778454364547773358663705417634",
"263335761710138676059012433263604661065",
"256635604553027450895274927888125010123",
"220583315956756343355432770079647256715"
]
},
"target": {
"file": "drivers/ata/libata-core.c"
},
"signature_version": "v1",
"id": "CVE-2022-49731-9aedc38a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a810bd5af06977a847d1f202b22d7defd5c62497"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"67777713513585031191794997350093110796",
"58478344964600928120531969734835269947",
"219351525089528926372144488224023144143",
"286598888391837768786036573192134052458",
"220848684778454364547773358663705417634",
"263335761710138676059012433263604661065",
"256635604553027450895274927888125010123",
"220583315956756343355432770079647256715"
]
},
"target": {
"file": "drivers/ata/libata-core.c"
},
"signature_version": "v1",
"id": "CVE-2022-49731-b833b5fb",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07cbdb4807d369fbda73062a91b570c4dc5ec429"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "51973205824083735797812865537542239435",
"length": 682.0
},
"target": {
"file": "drivers/ata/libata-core.c",
"function": "ata_host_alloc_pinfo"
},
"signature_version": "v1",
"id": "CVE-2022-49731-d12bf61d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a810bd5af06977a847d1f202b22d7defd5c62497"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"67777713513585031191794997350093110796",
"58478344964600928120531969734835269947",
"219351525089528926372144488224023144143",
"286598888391837768786036573192134052458",
"220848684778454364547773358663705417634",
"263335761710138676059012433263604661065",
"256635604553027450895274927888125010123",
"220583315956756343355432770079647256715"
]
},
"target": {
"file": "drivers/ata/libata-core.c"
},
"signature_version": "v1",
"id": "CVE-2022-49731-da2e08ce",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca4693e6e06e4fd2b240c0fec47aa2498c94848e"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "51973205824083735797812865537542239435",
"length": 682.0
},
"target": {
"file": "drivers/ata/libata-core.c",
"function": "ata_host_alloc_pinfo"
},
"signature_version": "v1",
"id": "CVE-2022-49731-e1b9c21c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@253334f84c81bc6a43af489f108c0bddad989eef"
}
]